第18回 OWASP Night のメモ

第18回 OWASP Night に参加したので、 OWASP が公開している資料についてまとめておきます。

# はじめに

ここでは、仲田翔一さん（[@shonantoka](https://twitter.com/shonantoka)）の「[Outreach Activities ＋ α](https://speakerdeck.com/owaspjapan/outreach-activities-number-owaspnight18th)」で紹介された OWASP のドキュメントを中心に抜粋しました。

発表では

> OWASP のドキュメントやツールはウェブシステムのライフサイクルにも活用できるのでは？

という視点から

> **要件定義**　⇒　**設計・開発**　⇒　**テスト**　⇒　**運用・保守**

というフェーズごとに「こんなドキュメントやツールを利用してみては」と提案されていました。

以下は、各フェーズごとに利用できそうな資料のリストです。

# 要件定義で利用できそうな資料

* ウェブシステム・ウェブアプリケーションセキュリティの要件書 [^1]

# 設計・開発で利用できそうな資料

* OWASP Proactive Controls [^2] （現在、仲田さんにより翻訳済・精査中とのこと）
* OWASP ASVS (Application Security Verification Standard) [^3] [^4] [^5]
* OWASP Cheat Sheet Series [^6] （現在、正式に公開されているものは 33 件、草稿段階のものが 14 件）

# テストで利用できそうな資料

* OWASP Zed Attack Proxy [^7] [^8]
* OWASP Testing Guide [^9]
* OWASP OWTF (Offensive Web Testing Framework) [^10]

# 運用・保守で利用できそうな資料

* OWASP ModSecurity Core Rule Set Project [^11]
* OWASP AppSensor [^12]
* OWASP Dependency Check [^13]

# その他

* OWASP Top 10 [^14] [^15]
* OWASP Mobile Top 10 [^16] [^17]
* OWASP IoT Top 10 [^18] （現在、仲田さんにより翻訳済とのこと）
* OWASP Snakes and Ladders [^19] [^20] [^21] [^22]
* OpenSAMM (Software Assurance Maturity Model) [^23] [^24] [^25]

# 補遺

以下は OWASP が公開しているチートシート（OWASP Cheat Sheet Series）のリストです。

## Developer Cheat Sheets (Builder)

* Authentication Cheat Sheet [^26]
* Choosing and Using Security Questions Cheat Sheet [^27]
* Clickjacking Defense Cheat Sheet [^28]
* C-Based Toolchain Hardening Cheat Sheet [^29]
* Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet [^30]
* Cryptographic Storage Cheat Sheet [^31]
* DOM based XSS Prevention Cheat Sheet [^32]
* Forgot Password Cheat Sheet [^33]
* HTML5 Security Cheat Sheet [^34]
* Input Validation Cheat Sheet [^35]
* JAAS Cheat Sheet [^36]
* Logging Cheat Sheet [^37]
* .NET Security Cheat Sheet [^38]
* Password Storage Cheat Sheet [^39]
* Pinning Cheat Sheet [^40]
* Query Parameterization Cheat Sheet [^41]
* Ruby on Rails Cheatsheet [^42]
* REST Security Cheat Sheet [^43]
* Session Management Cheat Sheet [^44]
* SAML Security Cheat Sheet [^45]
* SQL Injection Prevention Cheat Sheet [^46]
* Transaction Authorization Cheat Sheet [^47]
* Transport Layer Protection Cheat Sheet [^48]
* Unvalidated Redirects and Forwards Cheat Sheet [^49]
* User Privacy Protection Cheat Sheet [^50]
* Web Service Security Cheat Sheet [^51]
* XSS (Cross Site Scripting) Prevention Cheat Sheet [^52]

## Assessment Cheat Sheets (Breaker)

* Attack Surface Analysis Cheat Sheet [^53]
* XSS Filter Evasion Cheat Sheet [^54]
* REST Assessment Cheat Sheet [^55]

## Mobile Cheat Sheets

* IOS Developer Cheat Sheet [^56]
* Mobile Jailbreaking Cheat Sheet [^57]

## OpSec Cheat Sheets (Defender)

* Virtual Patching Cheat Sheet [^58]

## Draft Cheat Sheets

* OWASP Top Ten Cheat Sheet [^59]
* Access Control Cheat Sheet [^60]
* Application Security Architecture Cheat Sheet [^61]
* Business Logic Security Cheat Sheet [^62]
* PHP Security Cheat Sheet [^63]
* Secure Coding Cheat Sheet [^64]
* Secure SDLC Cheat Sheet [^65]
* Threat Modeling Cheat Sheet [^66]
* Web Application Security Testing Cheat Sheet [^67]
* Grails Secure Code Review Cheat Sheet [^68]
* IOS Application Security Testing Cheat Sheet [^69]
* Key Management Cheat Sheet [^70]
* Insecure Direct Object Reference Prevention Cheat Sheet [^71]
* Content Security Policy Cheat Sheet [^72]

# おわりに

個人的に、発表スライドの「Outreach Activities（研究成果の公開）」というタイトルからは「OWASP が公開している情報をもっと活用してほしい」という意気込みを感じました。

# 脚注
[^1]: https://www.owasp.org/images/8/88/Web_application_security_requirements.pdf
[^2]: https://www.owasp.org/index.php/OWASP_Proactive_Controls
[^3]: https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project
[^4]: https://github.com/OWASP/ASVS
[^5]: https://drive.google.com/folderview?id=0B4xgbqJzimL4fm11WTdIc2JBUkozTkdsbmZhQk5LTDR4TFgyYlBfQkhQbnZjVlZqQWVaSzA&usp=sharing
[^6]: https://www.owasp.org/index.php/OWASP_Cheat_Sheet_Series
[^7]: https://www.owasp.org/index.php/OWASP_Zed_Attack_Proxy_Project
[^8]: https://docs.google.com/file/d/0B1e1Cma1GUllazNUNVp6OWdGYzg/edit
[^9]: https://www.owasp.org/index.php/OWASP_Testing_Project
[^10]: https://www.owasp.org/index.php/OWASP_OWTF
[^11]: https://www.owasp.org/index.php/Category:OWASP_ModSecurity_Core_Rule_Set_Project
[^12]: https://www.owasp.org/index.php/OWASP_AppSensor_Project
[^13]: https://www.owasp.org/index.php/OWASP_Dependency_Check
[^14]: https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project
[^15]: https://www.owasp.org/images/7/79/OWASP_Top_10_2013_JPN.pdf
[^16]: https://www.owasp.org/index.php/OWASP_Mobile_Security_Project
[^17]: https://docs.google.com/document/d/1QOWOrsAo-33bHLdAZksKa4F_8_A_6XndoDF6ri4na_k/edit
[^18]: https://www.owasp.org/index.php/OWASP_Internet_of_Things_Top_Ten_Project
[^19]: https://www.owasp.org/index.php/OWASP_Snakes_and_Ladders
[^20]: https://www.owasp.org/images/c/c1/OWASPSnakesAndLadders-MobileApps-JA.pdf
[^21]: https://twitter.com/OWASPSnakesWeb
[^22]: https://twitter.com/OWASPSnakesMob
[^23]: https://www.owasp.org/index.php/Category:Software_Assurance_Maturity_Model
[^24]: http://www.opensamm.org/
[^25]: http://www.opensamm.org/downloads/SAMM-1.0-ja_JP.pdf
[^26]: https://www.owasp.org/index.php/Authentication_Cheat_Sheet
[^27]: https://www.owasp.org/index.php/Choosing_and_Using_Security_Questions_Cheat_Sheet
[^28]: https://www.owasp.org/index.php/Clickjacking_Defense_Cheat_Sheet
[^29]: https://www.owasp.org/index.php/C-Based_Toolchain_Hardening_Cheat_Sheet
[^30]: https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF)_Prevention_Cheat_Sheet
[^31]: https://www.owasp.org/index.php/Cryptographic_Storage_Cheat_Sheet
[^32]: https://www.owasp.org/index.php/DOM_based_XSS_Prevention_Cheat_Sheet
[^33]: https://www.owasp.org/index.php/Forgot_Password_Cheat_Sheet
[^34]: https://www.owasp.org/index.php/HTML5_Security_Cheat_Sheet
[^35]: https://www.owasp.org/index.php/Input_Validation_Cheat_Sheet
[^36]: https://www.owasp.org/index.php/JAAS_Cheat_Sheet
[^37]: https://www.owasp.org/index.php/Logging_Cheat_Sheet
[^38]: https://www.owasp.org/index.php/.NET_Security_Cheat_Sheet
[^39]: https://www.owasp.org/index.php/Password_Storage_Cheat_Sheet
[^40]: https://www.owasp.org/index.php/Pinning_Cheat_Sheet
[^41]: https://www.owasp.org/index.php/Query_Parameterization_Cheat_Sheet
[^42]: https://www.owasp.org/index.php/Ruby_on_Rails_Cheatsheet
[^43]: https://www.owasp.org/index.php/REST_Security_Cheat_Sheet
[^44]: https://www.owasp.org/index.php/Session_Management_Cheat_Sheet
[^45]: https://www.owasp.org/index.php/SAML_Security_Cheat_Sheet
[^46]:  https://www.owasp.org/index.php/SQL_Injection_Prevention_Cheat_Sheet
[^47]: https://www.owasp.org/index.php/Transaction_Authorization_Cheat_Sheet
[^48]: https://www.owasp.org/index.php/Transport_Layer_Protection_Cheat_Sheet
[^49]: https://www.owasp.org/index.php/Unvalidated_Redirects_and_Forwards_Cheat_Sheet
[^50]: https://www.owasp.org/index.php/User_Privacy_Protection_Cheat_Sheet
[^51]: https://www.owasp.org/index.php/Web_Service_Security_Cheat_Sheet
[^52]: https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet
[^53]: https://www.owasp.org/index.php/Attack_Surface_Analysis_Cheat_Sheet
[^54]: https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet
[^55]: https://www.owasp.org/index.php/REST_Assessment_Cheat_Sheet
[^56]: https://www.owasp.org/index.php/IOS_Developer_Cheat_Sheet
[^57]: https://www.owasp.org/index.php/Mobile_Jailbreaking_Cheat_Sheet
[^58]: https://www.owasp.org/index.php/Virtual_Patching_Cheat_Sheet
[^59]: https://www.owasp.org/index.php/OWASP_Top_Ten_Cheat_Sheet
[^60]: https://www.owasp.org/index.php/Access_Control_Cheat_Sheet
[^61]: https://www.owasp.org/index.php/Application_Security_Architecture_Cheat_Sheet
[^62]: https://www.owasp.org/index.php/Business_Logic_Security_Cheat_Sheet
[^63]: https://www.owasp.org/index.php/PHP_Security_Cheat_Sheet
[^64]: https://www.owasp.org/index.php/Secure_Coding_Cheat_Sheet
[^65]: https://www.owasp.org/index.php/Secure_SDLC_Cheat_Sheet
[^66]: https://www.owasp.org/index.php/Threat_Modeling_Cheat_Sheet
[^67]: https://www.owasp.org/index.php/Web_Application_Security_Testing_Cheat_Sheet
[^68]: https://www.owasp.org/index.php/Grails_Secure_Code_Review_Cheat_Sheet
[^69]: https://www.owasp.org/index.php/IOS_Application_Security_Testing_Cheat_Sheet
[^70]: https://www.owasp.org/index.php/Key_Management_Cheat_Sheet
[^71]: https://www.owasp.org/index.php/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet
[^72]: https://www.owasp.org/index.php/Content_Security_Policy_Cheat_Sheet